Summary
Security researchers have identified a new data-stealing trojan named ChocoPoC being distributed through a campaign specifically targeting vulnerability researchers, red teamers, and purple team operators. The malware is concealed within fake Python proof-of-concept repositories on GitHub that claim to exploit newly disclosed CVEs. When a researcher executes what they believe is a legitimate PoC, ChocoPoC silently runs in the background, stealing saved credentials and establishing persistent attacker access.
The attack is particularly cynical in its targeting: it goes after the exact population of people who are least likely to be fooled by unsophisticated lures — and exploits their professional reflex of quickly testing new PoC code. Repositories are crafted to look legitimate, often with plausible README files, fake contributor history, and timely publication relative to recent CVE disclosures. This gives them artificial credibility in the window when researchers are most likely to pull and run them.
ChocoPoC harvests browser-stored passwords, SSH keys, session tokens, and credentials stored in common developer tools. It then establishes persistence via scheduled tasks or cron entries and beacons out to attacker infrastructure. The campaign represents a maturation of the “researchers as targets” threat actor playbook, which has previously been used by North Korean APTs to compromise security professionals.
Sources
- eSecurity Planet — AI-Driven Attacks, Critical Exploits, and Global Breaches: July 2026 Roundup
- The Hacker News — Security Research Targeting Coverage
Commentary
Targeting researchers is a high-leverage strategy for sophisticated threat actors: a compromised security professional often has access to vulnerability databases, internal tools, customer environments, and red team infrastructure. The ChocoPoC campaign is a reminder that the security community is not immune to social engineering — and that professional curiosity is itself an attack surface.
The mitigation here is straightforward but demands discipline: always run untrusted PoC code in isolated VMs with no access to host credentials or production systems, never execute unfamiliar Python scripts from fresh GitHub repos without reviewing every line, and treat GitHub stars and forks as completely unreliable trust signals. If you pulled a CVE PoC repo from GitHub in the last two weeks without sandboxing it, rotate your credentials now.